660
7 Countermeasures Against Hardware Trojans
Bus controller
#1
Bus controller
#2
Bus controller
#3
Address
decoder
Slave device
#1
Slave device
#2
Slave device
#3
Fig. 7.2 Structural diagram of a standard address decoder for a system on chip. Here, the decoder
analyzes higher bits of the address and selects a corresponding slave device
The decoder structure contains a branched combinational logic for checking the
high-order bits of the address and activating the corresponding block of the slave
device. For example, if the high-order bits indicate the address corresponding to
Slave# 1, then the address decoder will instantly form a special SLAVE_SEL1 signal
accordingly. As a result, low-order bits of the address code will only be used to read
data from Slave#1.
Figure 7.3 shows a structural diagram of an original protected address decoder,
containing both the standard address decoder and the one introduced to ensure
security if an intruder tries to access confidential addresses [29].
“Confidential address beginning register” and “confidential address end register”
usually contain the values of specific addresses designed to identify ranges of confidential addresses. Embedded Trojan software configures these values as early as
during the initialization stage or automatically reconfigures them during operation
of the program.
The comparator also receives charged address signals from the master device,
compares them to the confidential address register and, if an unauthorized access
attempt is detected, immediately generates the corresponding signal of unauthorized
access detection. This signal instantly blocks all other signals of the sample of slave
devices, except for the only slave device set as default.
This signal of detection of unauthorized access is also connected to the interrupt
controller so that the CPU can accordingly process the malicious mode of the block
operation. The CPU automatically initiates launch of the interrupt service program
to identify information about the malicious master device and the specific address
of unauthorized access and immediately initiates the relevant countermeasure. It is
important to know that the characteristic of recognition of such malicious master
device will be saved in the special register of masking the malicious master device
7 Countermeasures Against Hardware Trojans
Bus controller
#1
Bus controller
#2
Bus controller
#3
Address
decoder
Slave device
#1
Slave device
#2
Slave device
#3
Fig. 7.2 Structural diagram of a standard address decoder for a system on chip. Here, the decoder
analyzes higher bits of the address and selects a corresponding slave device
The decoder structure contains a branched combinational logic for checking the
high-order bits of the address and activating the corresponding block of the slave
device. For example, if the high-order bits indicate the address corresponding to
Slave# 1, then the address decoder will instantly form a special SLAVE_SEL1 signal
accordingly. As a result, low-order bits of the address code will only be used to read
data from Slave#1.
Figure 7.3 shows a structural diagram of an original protected address decoder,
containing both the standard address decoder and the one introduced to ensure
security if an intruder tries to access confidential addresses [29].
“Confidential address beginning register” and “confidential address end register”
usually contain the values of specific addresses designed to identify ranges of confidential addresses. Embedded Trojan software configures these values as early as
during the initialization stage or automatically reconfigures them during operation
of the program.
The comparator also receives charged address signals from the master device,
compares them to the confidential address register and, if an unauthorized access
attempt is detected, immediately generates the corresponding signal of unauthorized
access detection. This signal instantly blocks all other signals of the sample of slave
devices, except for the only slave device set as default.
This signal of detection of unauthorized access is also connected to the interrupt
controller so that the CPU can accordingly process the malicious mode of the block
operation. The CPU automatically initiates launch of the interrupt service program
to identify information about the malicious master device and the specific address
of unauthorized access and immediately initiates the relevant countermeasure. It is
important to know that the characteristic of recognition of such malicious master
device will be saved in the special register of masking the malicious master device